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No 60/460,045 of Kurt A. DOBBINS el el, filed April 4 > 2003 ' titled M 2 ™ 015 
APPRATUS FOR OFFERING TAGGED CONTENT PREFERRED TRANSPORT 
WITHIN A BROADBAND SUBSCRIBER NETWORK; and U.S. Provisional Patent 

MET hodandapprat U sforc„arg W gandaggkega™gone W e 

TRANSACTIONS THROUGH BROADBAND CARRIER BILLS. The entireties of 
^provisional applications are incorporated herein by reference. 

BACKGROUND 

Field of the invention 

Thepresent — rel a t es ,„ nrethods and apparamaes for and 

forced— — — — 
^ss — — . — — 



access 



facility such as abroadband subscriber network. 



Description of Related Art 
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. , nsdifferently For example, a 911 call over an IP network would 
content transmissions dillerenuy. ™ 

^mavre.nire^en.e^e^en „han free downloads ofamov, fi le even 
.hough the file exrensions and sizes may be equivalent. 

,0000, THispro.lernuutilnownasbeeninHerentinpaeket-swttehne.orKtn, Efforts 

appro p ri a,e 1 ,T h epriora rt ,ec 1 uu,uesea m ro,ensureper f eetdes, g „a,,o„o ffl owso f 

appUcabon-specincbas, (T bose ne M or k s mclude, for exanrple, nrultrple servree 

Subseriber Line ("DSL") providers sueh as loea, telephone eompan.es.) 

^adeleteHouseffeetonbtoadbandaeeessprovider, abthtv toprov.de umformand 
^^lu.emetaecessservtcetotheir—.Tobesure.widespreaduseof 

P2P networks has proliferated prraey of copyrighted mus.e and v.deo. St.,., P2P 
.twotksprovideusersw.mimportantu^.Oneo.ectofthepresen—Uto 
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as preferred <ranspor,ers .ha, are ab.e ,o cognize pner-«o-peer traffic based on 
appUeation er con,en, rags and to hea, M naffic aeeording to policies tha, pro.ec, 
desired business or legal interests. 

archi.ec.nre is ft* an inordina,e anronn, of s,orage and connect is needed a, ft. 
con ,e„, server ,„ enaHe pnh.ic nsers ,0 access _ iarge sized fdes for downioad 
over Interne,, in addition, high-speed pnbUc circni,s are cosdy and tow- 

speed fn.enre, circui, -nay no, provide ade,na,e bandwid,h and speed for con.en, 
distri bn,,on.hnsnchpeer,opee r nehvor k s,Uae,as k ofs,on„gandforwardin g pop^ 

fil e sis dis tt ,bn,ed,oapoin,whe rete ac«,a 1 con SU nrercHen,device SS ,ore and forward 

1 a rg e fil esovera W ideareane l wo A snchas tt ,e,„,e m e,.Ye.,in,hecn n en,s,a,eof tt ,e 

«, peer ,0 peer disunion sehenres, *. con,en, original teases controt over the 
.ranspor.anddisnihnhonofhheorigina.eon.enM.neei, is served anddis^hy 

mu ,Up 1 enodeswi,hin,hepeerne W or k . I ,isn 1 ere f orea I ,oh J ec,of U aepr«en,inven, i o„ 

t0 provide a sys,enr ,ha, enah.es a con,en, original ,0 mainrain con.ro. over the 
tt anspor< and distribution of eon,en,, even as ,he con.en, is offered on peer ,o peer 
networks. 

,0009, A „hesa m e.,n,e,peer,opeerne W or k s,nereases,heden 1 andforhans m iss,on 
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th „se networks. One known solution for ft. broadband access providers is ,0 passive* 
identify P2P traffic and rate find, it. Another solution is to subject subscribe, to periodic 
byte caps, especial* to Umi, the amoun, of data they are permitted to upload. However, 
tere is a need for a system that allows broadband access providers more direct contro! 
over the transmission of content on a broadband access network. 
10010] in addition, these available peer-to-peer programs, which spread tire costs of 
content distribution by using clients' networked compute* as content servers, are 
wreaking havoc on broadband subscriber network, Those networks were designed for a 
substantia, amount of downtime a, each Cent, and assuming tha, clients browsing the 
web and downloading a page wou.d demand far less uploading bandwidth and pay.oad 
„„ the network than downloading bandwidth and payload. Often, those peer-to-peer 
programs become havens for the distribution of pirated or other illegal matenal. 
Increasingly, legtslative efforts and law enforcement are focusing on stopping that illegal 
conduct at the broadband subscriber network level. 

PHI] Furthermore, applications can use techniques knovm as port-hopping and port- 
spoofing to mask tire origination point of a transmission. In the IP communications art, 
destination nodes can recognize and route transmissions sen, by certain applications 
teough certain communications ports according to generally recognized port number 
assignments se, by centra, authorities like the Interne, Assigned Numbers Authonty 
("IANA"). Bu, ,hose ports are eite assigned by IANA, or are assigned defac.o (an 
apptications sUrt using ten - this is known as -*U known ports"). IANA designa.es a 
reserved se, of ports for well-known applications. IANA also establishes a se, of 
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unreserved well known ports that are available for new applications to use on a de facto 
basis. 

10012] Whether reserved, assigned, or defacto - there is no known or generally 
recognized authentication or security scheme in place to ensure that only proper 
applications gain access to their proper communications ports at IP destination nodes. 
So whenever an application requests use of a certain port in IP communications, in the 
current state of the art, there is no way for the destination node to ensure that the 
communication actually was initiated by that application. In fact, spoofing the generally 
accepted port selection system is a simple affair, used by unrecognized applications to 
gain entry or carriage into IP routing systems. 

[0013] One well-known technique incorporated into certain unfavored Internet client 
applications is known as "port hopping." Applications using this technique will 
distribute their content transmissions or requests on a random, pseudorandom, or 
programmed pattern among a variety of reserved or well-known communications ports. 
This allows unfavored applications to escape easy detection, and to usurp ports left open 
by IP destination nodes for necessary or favored applications. 
[0014] In networks that are not public packet switched networks, such as cable 
television or telephone, the business of telecommunications carriage is enabled by 
bundling content or applications with network access. Contrast the sustained and 
successful business model of the traditional television industry with the commoditization 
of the Internet access industry. Broadcast, and even cable, television operations are 
supported largely by (i) advertisers paying for the privilege of having their content 
carried on public networks by the operators of that network; and (ii) more importantly by 
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subscribers paying for content by channel bundles, pay per view, or other content 
transmission specific services. But such a model is not available to Internet access 
providers, who until now have been unable to monitor or control the content or 
applications made available to their own subscribers. 

[0015] There is a need in the art for a method of positively identifying information 
transmitted to network access points such as broadband subscriber networks. The 
information could be identified by at least one of client application, content origin, type 
or class. Such an identification scheme could be known only by certain access points, or 
standardized for recognition by all nodes and content servers. Various levels of secure 
authentication could be used, including without limitation a shared secret, one-way 
encryption tags, or private-public key exchange. Such a method would enable any owned 
network resource, whether a switch, router, communications port, or even a given 
subscriber or subscriber group to require authentication. The scheme for identifying 
content could be extensible and predictable employing for example, hierarchical naming 



trees. 



SUMMARY OF THE INVENTION 

[0016] In one aspect, the invention relates to a content tag associated with a content. 
The content tag includes a content tag indicating the type of service to accord to the 
content. The content tag is created in a first instance and the content tag is read in an 
instance of network transmission. Flow information is generated for the content, the flow 
information including information specifying the type of service indicated in the content 
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tag. At least part of the content is transmitted according to the type of service 
specified by the flow information. 

[0017] One advantage of the present invention is to alleviate the negative impact of 
peer-to-peer networks by deploying inline systems such as preferred transporters that are 
able to recognize peer-to-peer traffic based on application or content tags and to treat that 
traffic according to policies that protect desired business or legal interests. Another aim 
of the present invention is to offer affirmative authentication to truly favored applications 
to help ensure that only those applications gain access to their reserved communications 
ports. 



BRIEF DESCRIPTION OF THE DRAWINGS 

[0018] FIG. 1 illustrates the basic topology of a typical public broadband 
telecommunications network within which the present invention operates. 
[0019] FIG. 2 illustrates a communications link between a cable modem broadband 
subscriber and the Internet in an MSO administered broadband subscriber network. 
[0020] FIG. 3 illustrates an architecture of a personal computer such as a personal 
computer connected by subscribers to a network access provider such as a broadband 
subscriber network. 

[0021] FIG. 4 illustrates a communications link between a cable modem broadband 
subscriber and the Internet in an MSO administered broadband subscriber network 
employing a Preferred Transporter under the present invention. 
[0022] FIG. 5 illustrates the communications link of FIG. 4. 
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[0023] FIG. 6 illustrates a communications link between a client and a content server in 
a digital communications network. 

[0024] FIG. 7 illustrates a communications link between a client and a content server in 
a digital communications network interconnected by the Internet. 
[0025] FIG. 8 illustrates a network topology of requesting clients and transmitting 
clients over the Internet. 

[0026] FIG. 9 illustrates a network topology of a peer-to-peer content distribution 
networks. 

[0027] FIG. 10 illustrates a network topology of a peer-to-peer content distribution 
network interconnected by the Internet. 

[0028] FIG. 11 illustratesafunctionalblockdiagramofaflow-basedpreferred. 

transporter in accordance with one aspect of the present invention. 
[0029] FIG. Uillustratesafunctionalblockdiagramofahardwareimplementation 
capable of implementing the functions of the packet processor and switching fabric, in 
accordance with one aspect of the present invention. 

[0030] FIG. 13 illustrates a full hardware instantiation of a preferred transporter 

apparatus in accordance with one aspect of the present invention. 

[0031] FIG. 14 illustrates a communications link for content carriage and 

authentication communications between a content transmitting network node inside or 

outside of a network access provider's subscription servxce to areceiving client node 

inside of a network access provider's subscnption service such as a broadband subscriber 

network. 
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[0032] FIG. 1 5 illustrates a communications link for content carriage and 
authentication communications, in which authentication may be implemented with a 
network node other than the node originating the content transmission, in accordance 
with one aspect of the present invention. 

[0033] FIG. 16 illustrates a communications link for content carriage and 
authentication communications, in which authentication may be implemented with a 
network node other than the node originating the content transmission, in accordance 
with one aspect of the present invention. 

[0034] FIG. 17 illustrates the contents of an exemplary content authentication tag 
according to one aspect of the present invention. 

[0035] FIG. ISdescribesexamplesofpossiblefieldsforinclusioninacontent 
authentication tag under the present invention. 

[0036] FIG. 19 illustrates a communications and decision flow for validating a node by 
signature for transmitting content to a client in an access network in accordance with an 
aspect of the present invention. 

[0037] FIG. 19a is a flow chart depicting a method for preferred transport. 
[0038] FIG. 20 illustrates a communications and decision flow for validating a node by 
' signature and shared secret for transmitting content to a client in an access network in 
accordance with an aspect of the present invention. 

[0039] FIG. 20a is a flow chart depicting a method for preferred transport. 
[00401 FIG. 2 1 illustrates a communications and decision flow for validating a node 
using realtime signaling of one-way authentication messages for transmitting content to a 
client in an access network under the present invention. 
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(0041] FIG. 21a is a flow chart depicting a method for preferred transport. 

[0 0421 FIG. 22 illustrates a communications and decision flow for authenticating an 

item of content for preferred transport, wherein a content sending server identifies and 

interprets a instructions coupled to an item of content, and instructs a preferred 

transporter to carry the content transmission accordingly. 

[00431 FIG. 22a is a flow chart depicting a method for preferred transport. 

(00441 FIG. 23 illustrates a communications and decision flow for authenticating a 

content transmission for preferred transport, wherein a preferred transporter identifies, 

interprets and executes instructions contained in a transmission request from a content 

receiver. 

(00451 FIG- 23a is a flow chart depicting a method for preferred transport. 
,00461 FIG. 24 illustrates a communications and decision flow for authenticating an 
item of content for preferred transport, wherein a preferred transporter identifies, 
interprets and executes instructions in mid-transmission according to a tag coupled to an 
item of content. 

|0047| FIG. 24a is a flow chart depicting a method for preferred transport. 

,00481 FIG. 25 illustrates an exemplary root naming tree for content authentication hags 

under the present invention. 

[00491 FIG 26 illustrates an exemplary content authentication tag naming tree for a 
content class or type subordinate naming tree under the present invention. 
[00501 FIG 27 illustrates an exemplary content authentication tag naming tree for a 
content application subordinate naming tree under the present invention. 
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[0051] FIG. 28 illustrates an exemplary content authentication tag naming tree for a 
content origin subordinate naming tree under the present invention. 

DETAILED DESCRIPTION OF THE INVENTION 

[00521 In one embodiment, the present invention provides a marking, also herein 
interchangeably referred to as a content tag, which is associated with content traveling 
across a network. The content tag provides information, for example, concerning the 
format, origin, client application, type, or class of the content. 

[0053] In one embodiment, the present invention allows a network access operator - 
such as, for example, a DSL carrier, an MSG, an ISP, or WISP or any broadband or 
public or private network access provider - to verify, authenticate and offer differentiated 
service for content transmissions that are marked at an earlier point in distribution, for 
example, by associating them with a marking or content tag. That earlier point can be at 
the time of content creation, origination of transmission by a content server or peer client 
application, or at a midway transmission or distribution point. The marking or content 
tag can be associated with a piece of content regardless of the form of distribution or 
transmission that brings it to the network access operator to carriage to end users. Such a 
tag or another form of node or affirmative application signature can also be applied to 
transmissions on a "node specific" basis, i.e., at the point the transmission is originated, 
including among others by a content server, peer-to-peer client, supernode, or any other 
node that originates or carries the transmission through. 

[0054] In one embodiment, the tags of the present invention are structured in a manner 
that is machine readable, and standardized for extensibility. Among others, a naming- 
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tree method of structuring 



the lexicon for those tags is taught. In one embodiment, tags 
ntinimal.y include a. leas, one designation of the nature of .he content heing — ed. 
Tha, a. leas, one designation can include, by way of example, content type, content class, 
transport tenements, port designate digital signature, parent information, content- 
earriage financial or business purpose designations, or other information. 
,00551 One embodiment permtts the access network operator to authenticate the tags 
prior to opening network access to the information fiows that each such tag destgna.es. 
That authentication can be accomphshed, for example, in any number of "on, of band" 
or real-time authentication techniques known in the art. 

,0056] In embodiments of the present invention, transmission authentication may be 
achieved in any number of ways, including, bu, no. limited .o, me following: 

(i) Ou, of band au.hentica.ion can be performed by inspecting Ure contents of the 
tag for a secret shared by the network access operator on Ure one hand, and the entity 
requesting differentiated transport on the other. Then the preferred bansport node (or 
another node to which the authentication task is outsourced) can decrypt any encrypted 
tag according to such a shared secret (or other means), by seeking authentication data 
buried wtthin the tagged data and operating upon it according to any combtnation of 
shared secret numbers, shared score, formulas, shared secret algorithms or other shared 
secret infortnation decrypted fiom .he tag, or shared secretly wi«h the entity requesting 

preferred transport among other ways. 

(ii) m another embodiment of the present invention, the authentication can occur 
in real time for extunple by .he network access operator requesting auu.en.ic responses 
from a server or other network node operated by the entity requesting authentication. 
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Such a real time aumenticauon may be accompltshed using one-way authentication 
.echniques sueh as sing.e key cryp.og.aphy, or by two-way authentication technic 
such as a twin key or public key/private key exchange. 
,00571 Once the access network operator identifies a tag, authenticates a tag, or 
otherw.se permus a tagged transmission request, Ore access network can conunence a 
flow of information transmission according to the instructions in the tag and the packets 
of the transmission. Such differentiated treatment can compnse any number of 
tta „sm,ssion or end user presentation values. Taught herein are a number of exemplary 
embedments of such differed treatments. These examples ane offered as methods 
of applytng the transmission taggtng and preference aspects of the present invention. 
However, other tagging and preference implementations wU, be apparent ,0 those skilled 
in the art, and the tagging and preference aspects are no. timtted to the particular 
applications described. 

[0.58) Those examples include, among others, increasing bandwidth to he al.ocated to 
flre transmission beyond the access network operator's default ,eve.s; hfting rate 
.imitations mat may be in place restricting certain application or content fiom 
tra nsm,s S ion or reception on the access network; lifting byte caps or byte counters used ,0 
me ,er the consumption of bandwidth on the access network; eliminating double bflhng 
for network access usage when certain types of content are consumed (for example, a pay 

tiyte cap meters); preferring .ega, content and discouraging illegal transmissions as a way 
t0 meet and enforce regu.atory requirements of digitid content distribution (for examp.e, 
copyright-protected content should no. be distribute without d,gital rights enforcement); 
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reS efflng network access to con.cn, providers as a way of providing access ,0 broadband 
access subscribers and distributing content, in whtch content providers may share 
revenues or pay for carriage; and permitting end users to purchase h,gher bandwidth upon 
demand as a means of enhancing the time-based value of content. 
,0059, The foliowing descriptions are presented in terms of display tmages, algorithms, 
and symbolic representations of operations of data hi. wtthin the memory of computer 
devices and nodes in a digital con—ions network. These a.gorithmic descriptions 
and representations are the means used by those skilled in the data processing aris to 
convey most effectively the substance of their worlc to others skilled in the art. An 
a.gorithm is here, and generally, conceived to be a self.onsis.ent seance of steps 
teading ,0 a desired resu... These s.eps arc .hose retiring physical manipulations of 
physical quantities. Usually, mough no. necessarily, these quantities take me form of 
Centrical or magnetic signals capable of betng store., transferred, combined, compared, 
and otherwiscmanipnlated. tt proves convenien. a. times, principally for reasons of 
common usage, to refer to these signals as bits, values, Cements, symbols, characters, 

and stmilar terms arc ,0 be asso.ia.ed with the appropriate physics, quantities and are 
merely convenien. labels applied to these quantities. 

,0060, in me present case, tire operations can a,so be machine operations performed in 
conation witit a human operator. Useful machines for performing the operations of the 
pre sen, invention utc.ude general purpose digital computers, network switches, hubs, 
routers or other similar devices effecting decisions regarding .he transmission of da«a. In 
an cases, there should be home in mind the distinction between the method operations of 
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itsdf Th e presen, invention reU.es to nreurod steps for opening et.tnpu.ers and those 
anodes andp—e^ea, or other physiea, signal ,o generate other 

desired physical signals. 

imn The present invention a,so reia.es .0 appals for performing .hese operations. 

ilte e„,,y re,a,d .o any par.ieu.ar con.pn.er. ,n parueu,ar, various general pnrpose 
pr0 ve nrore eonvenre, .o co„s.rne. nrore spee.ati.ed appals .o perfom, the quired 
description given below. 

l0OM1 One aspect of tire present — reia.es .0 the —on of —on .0 
en d»sersbyane t worit accessor. Those users ean he, bn. are no.hnri.ed .o. re., 

^ribe^nefw^canbe^^ 

eonuuun.eanonsdeviees.Tha.ne.wor.aceessprovidereanhe.hu.isnoU-ed.o.a 

^.o.he^oranrunip.eserviceopera.orofacahie.etevis.ons^offenng 
^^ersh.oadhandaeeess.o.heMeme.viaeahienrodem.Anyof.hee^p.esor 

processes ascribed ,o a broadband subscriber servtce, netwo* aeeess provider, or 
^opera.oreanheperforn.edbyanyof.beforegoing.orbyanyaggrega.eprov^ 

of aeeess to any dig..a> c—ic arions nepers aeeessed by a. leas. W o end potnts. 
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[00631 Many embodiments of the present invention are possible and various methods 
of indenting the tnventton will be apparent to those skilled in the art. However, one 
par.icn.ar embodiment of the invention will be described in detail with reference to the 
accompanying figures. 

100641 FIG. 1 depictsabasietopologyofatypicalpubhc broadband 
telecommnnications access network within which the present invention opem.es. One 
example of such an access network is a broadband subscriber access network. Public 
users .ypicady re.y on such networks .o access very large worldwtde compn.er networks 
such as .he Interne.. Mos. of .he examples in this specification reference such broadband 
subscriber access networks and the Interne.. Examples of major broadband subscriber 
access networks currently in operation in North America include Corneas., TimeWamer, 
and BellSouth. In some instances, access is provided to end users over the cable 
teievision infrastructure. In other instances, access is provided by means of special so- 
caned "digital snbscriber Hue" or DSL connections offered by a local telephone carrier. 
In still outer ins.ances, a, leas, downstream connectivity can be provided via sateUite or 
other wireless conununications systems such as MMDS or LMDS. The depiction of FIG. 
, mustm.es the way in which an access provider using any of these modalities typically 
provides subscribers with access to the Internet. 

[00651 That topology is divided into ihree areas - a Core area 100, a Distribution area 
130, and an Access area 1 50. 

[00661 Core area 100 can connect to an access provider's core network 105 (which can 
be a DOCSIS compltam network) with multiple points of presence such as POP 110 used 
for interconnecting the access network's headends and bridging ,o access the Interne, 
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backbone. Such POPs in turn interconnect outside of the access provider's network to 
other POPS connected to the Interne, by other access providers such as network clouds 

,15 offered by providers like Sprint, UUNe. or Digex, and to the regrona. data centers 

120 for services that remain on the providers network. 

[00671 The distribution area 130 can connect with headends such as a headend 135 
together for management, and to provide outside network services such as connectivhy to 
.he inter,* through the access networks ownDOCSIS backbone ,05. Each headend 
can provide service ,o a certain geographical area, routing tiaffic using one or more 

access network ptarahry of geographical dispersed headends can he interconnected by 
a transport ring . 55 that routes traffic ,o regiona, hubs ,60. Those regrona, hubs can 
distribute communications revested by individual subscribers. Subscribers can be 
pr0 vided network access by various known means such as cable modems, DSL modems, 
or any other broadband customer premises equipment. That customer premises device 
can be connected via the network access provider's wires or spectnrm to a subscriber Hue 
.ermination device 165. In the case of a cable modem network, tha, devrce is a,so known 
as a Cable Modem Termination System (CMTS). In the DSL context, that device is a,so 
known as a Digital Subscriber Line Access Multiplexer (DSLAM ). The transport nng 
,55 elements, along with the regrona, hubs 160 and the subscnber line devices 165 are 
commonly referred to in the art as the Access (150) area of the broadband access 
network. The core ,00, drstribution ,30, and access 150 may be interconnected by any 
high-speed technology transport. 
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Vm FIG. 2 iUustrates the pad, by which a broadband access netwo* interconnects 
...d-subscHb.^elntemet. A— canons device 2 M can connect w«h a 

modm21 0.Sucha m ode m21 0ca„func«on.o r ece i ved igit al— aionanontthe 

waV es ie ta,sin,od lg i,aUaU— ,ons. That n,ode m 2i0 can connect, over the 
^pro^swiresorradiospec^.on.eaccessne^sc^aUaciUnes 

aescribed above, at which point another modem termination device may Cher 
mo dem termination device mterconnecU with a, least one action switch 230 «ha. 

Wiethe accesaprovider.nerworaorinawideareaorpubhcnetwor.suchasme 
access network. 

100691 FIG 3 ihustrates a compnter 300 in accordance with one aspect of.be present 
inve „hon The computer 3O0 is one e.amp.e of the communications device 200 
2 The computer 300 may be or inciude a persona, computer, minicomputer, 

^te.ephone.Theconrputer.Ocanbeusedasanumberofe.ementsinthepresen, 
syst em. For e*amp,e,o„eor more computers 300 can be used as chent Internet access 
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devices, content servers, or by access network operators for various management, con.ro., 
administrative, or operational roles. 

10 070] The computer 300 includes a processor 305, which may be or include a standard 
digi ,a, computer microprocessor, such as, for examp.e, aCPU of me Intel Pentium series. 
Pressor 305 runs system software 320 (such as, for example, Microsoft Windows®, 
Mac OS® or another operating system for genera, purpose computers), which is stored on 
storage unit 3.0, e.g., a standard internal fixed disk drive. App.tca.ion programs 330, 
also stored on storage uni. 3 10, include, for example, computer program code for 
receiving, using, and sending information fiom and ,o a public network such as fire 
mtemet Examp.es of common app.tca.ion programs 330 include web browsers, Interne. 
.e.ephoneprog^s.s^eamingmediap.ayers.e-mai.ornewsgroupcUen.s.andpeer-.o- 

peer dismbufion clients. Application programs 300 carry on. many of fire client stde 
tasks and steps described below, including the exchanges of aumen.ica.ion information 
with a preferred rtansport apparatus under presen. invention. Human-readable outpu. is 
transmits from processor 305 .0 an outpu. device such as a video monitor 340 for 
display to users, and many computers 300 a.so include speakers, printers or other 
multimedia output devices. Users utilize input devices such as standard personal 
computer keyboard 350, enrsor con.rol device 360 (e.g., a mouse or trackball), touch- 
seteen sensors on me monitor dtsplay, virtual reality gloves, voice input, or similar 
techniques ,0 en.er commands employed during their access and use of public computer 
networks. Software for imp.emen.ing a c„en. under .he presen. invention may be stored 
in a variety of locations and in a variety of mediums, including withon. limrtation, RAM, 
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a floppy disk, 

,007.) FIG. 4 depicts the path by which a broadband access network interconnects an 
end-subscriber to the .nternet. Tire path inelndes elements deptcted in FIG. 2. The pad, 
also includes a prefetted transporter 400, comprised of a servtce logtc engine 4,0 and a 
preferred transporter switch 420. The preferred transporter 400 is used, for example, to 
identify, interpret, and authenticate tags appended to transmissions or content; and a, 
Umes to interact with the sending entity or .he content ortginator ,o determine and 
execute specified preferred transport parameters. The preferred transporter switch 420 is 
a flow-based IP appliance that interprets, recedes and manages flows between fire 
existing eqnipmen, and nodes of the Interne, or of the broadband access neurit. A 
preferred transport could be embodied in a wiety of network e.ements, snch as c.icnt or 
server software, speciafized network appliances, or as a subsystem on an existing network 
element. 

,0072] FIG. 5 shows the path of FIG. 4, in which bom the hardware switch and service 
log ic elements of a prefetred transporter are shown as a sing.c block 500. 
,00751 A preferred transporter under the present invention can be extensib.e so that it 
operates to identify and afford the expected transport for content coming ftom the ontstde 
t0 the tnslde of a broadband subscriber network, ftom the inside to the outside of a 
broadband subscriber network, or ftom one nCe inside to another node inside of a 
broadband subscriber access network. A preferred transporter can operate in any point to 
point, point to multipoint, or mn.tipoin. to mnltipoin, content distribution scenario. 
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[00741 Broadband content distribution over the Internet may be, for example, 
implemented as a Server-Client distribution, which is substantially point to point or point 
,o multipoint; or a Peer-.o-Peer scenario, which is substantially multipoint to multipoint. 
Positively identifying content tiansmissions for preferred transport in the former scenario 
ean, in some implementations, be aecomp.ished on an apriori basis between a preferred 
transporter and any provider of broadband content. 

,0075] However, the peer to peer scenario involves so many individual nodes both 
within and outside of a broadband access nertvork demanding both send and receive 
requests, that ease-by-ease measures are not favored. To solve tints complexity in 
authenticating content in mid-transmission, one embodiment enables any application to 
register with the preferred transporter allowing subscriber devices running that 
application in accordance with parameters agreed between the application provider and 
the preferred transporter. A further embodiment of the present invention enables that 
identification and treatment for preferred transport to be embedded in lags that are 
eoup.ed ,0 the content. Those tags can be identified, read, authenticated and followed by 
a preferred transporter, or a sending server upon sending a transmission request to a 
preferred transporter. In this way, a preferred transporter under the present invention 
would always afford the same treatment to identically tagged content files, regardless of 
which content server, or peer to peer client is sending the content file. This allows 
original content to be dtstributed with the same preferred transport and authentication 
measures even after i, leaves the originating server and is served by anonymous nodes 
with in a peer-to-peer network. Examples of tagging content and ways in which a 
preferred transporter reads, obeys and enforces those tags are provided below. 



22 



,00761 FIG. 6 illustrates a basic point to point content server to Internet client 
connection, and FIG. 7 illustrates the same type of point to point content server to 
Int eme, client connection, intermediated or de.ivered over a pubtic packet switch network 
such as the Internet. FIG. 8 illustrates a communications network used by content servers 
to transmit files to efienta. FIGS. 9 and 10 i.lustiate peer to peer, multipoint to multipoint 
content distribution scenarios. 

10 077I FIGS. 5-10 reference a command syntax used in hypertext transfer protocol 
(Up) for requesting transmtssion of stored files, and sending .hose files in response. Http 
is explained in detail in the Interne, Engineering Task Force RFC 1945 HTTP, which is 
incorporated herein by reference in its entirety. 

,00781 One embodiment of .he invention incorporates a preferred transport subsystem 
m can be deployed in a number of implementations of preferred transport. This 
preferred transport subsys.em is referred to as a "flow based" access network 
archi.ec.urc. The flow based access network architecture is a preferred transport 
subsystem that can be deployed in a number of the embodiments of preferred transport 
under the present invention. Such a network architecture is equipped with hardware or 
software components allowing key network managemen. Cements to treat information 
transmissions on a file or a per-— sion basis rather than jus. on a packc. basis. In 
one embodiment, the flow based system includes flow-based switching managed by a 
flow table. Such flow tables give identity to end-.o-end or source-,o-destma.iou 
communication exchanges. In .he flow-based architecture, upon packet arrival, certain 
fie,ds are extracted from the packet, and flow-based elements use a unique identifier as a 
key into the flow table. If there is a match, then the packet is switched in process 
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accordmg to the service attributes of the flow table entry. Otherwise, the packet is further 
processed in order to establish a new flow entry in tha, flow table. An access network 
objective in e-np.oying a flow-based subsystem is to ensure that every packet in a 
transmission flow is accorded the same service, and avoiding the need to assess and 
assign service to every individual packet. 

,00,91 The flow based access network architecture in accordance with one particuiar 
embodiment of the present invention wiU be descnbed with reference to FIGS. 11-13. 
,00801 FIG. 11 illustrates a functional block diagram of a flow-based preferred 
transporter in accordance with one aspect of the present invention. In one embodiment, 
dements of a flow-based subsystem include packet procesamg in such a way as to 
agnize flows between end-to-end systems and applications. Flows are managed by a 
eomponen, that determines when to eteate new flows, and another element that maintains 
existing flows including removing them from the flow table whenever they arc no, betng 
used, or changing the transmission characterises during Ore carriage of a flow. Packet 
processing and flow switching can be implemented in hardware, software or a 
combination thereof. 

,008!) In such a system, packet processor and switching fabric 3700 includes 
hardware, software, or a combination thereof, that receives packets, extracts certa,n fields 
torn the packets and payload to form a flow key, and looks up in a flow table for a 
ma ,ch. Upon a match, the packet processor and switching fabric 3700 perform a 
switching function transporting the packets through one or more physical interfaces or 

rate Hunting, or other flow based services that are desired by an access network. 
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,008 2 , Upon a miss in the flow lookup, packet processor and switching fabric 3700 can 
hand ft. packet off to a non-switching element (such as, for example, transporting 
faough a HW API 3705 to a non-switching component such as a preferred transport flow 
cre a,ion block 3710). Such a non-switching e.emen. can further process the packet .0 

bl0 ek 37,0 determines that a new flow is quired, then the HW AP. 3705 couid create a 
flew table entry for the packe, processor and switching fabric 3700 with respec, .0 the 
inspected packet and tamer packers in mat flow. (Whether Anther packets be.ong in mat 
flow are determined by a number of cnteria as discussed above in me definition of 
"How.") Further to determining and identifying a new flow in the flow .able, that 
preferred transport flow creation step 3710 a,so may instruct me packet processor and 
switching fabric 3700 as to me service aunbu.es to be accorded .0 .ha. newly crea.ed 
flow. 

10083] in one embodiment, .he flow-based preferred transporter also includes a 
mature & con.en. .ag managemen. block 37,5, an aumen.ica.ion server b.ock 3720, a 
flow maintenance b,ock 3725 (including, for examp.e, a signature poficy change 
function), a signamre poHcy managemen. b.ock 3730 a service logic engine 3735, and a 
signature registration block 3740. 

,00841 One aspect of me presen. invention can recogmze affirmatively marked or 
.„ g ged» comen. (as described be,ow). Once recognize., a .agged content tiansmission 
can be processed for preferred transport, regards of .he communications pa.b or port 
flra, „ comes in by - .ha. is, re g ard,ess of .he source or destination of me nansnussion. 
This con.en, .ag recognition scheme therefore would override me tiaditiona. flow 
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cr ea,io„ vanab.es and flow maintenance parameters, in favor of following predetermined 
instructions intended for eon.ent transmissions identified with those tags. 
,0085) Preferred transport flow creation block 3710 may recognrze the nse of a content 
.ag and can establish a flow based on the instiuctions indicated by the tag. In one 
embodiment, some tags reonire anthenticafion, nnder a more secum flow-creation and 
tre annen. embodiment described below. A Signahrre and Content Tag Management 
element 3715 can cany ou, that task when necessary. In addhion to managing the 
anthenticafion of that tag, that stgnamre and content tag management block 3715 might 
ma „age the association of signages and tags with eommnnicattons parameters. 
100861 in one embodiment, the flow-based preferred transporter a.so includes an 
anthenticafion server 3720. The authentication server 3720 is, for example, any node in 
,he network that performs tag anthenticafion. This can be a separate devrce conp.ed to 
th e preferred transporter and managed by the access network provider. Alternately or in 
addition, the anthenticafion block 3720 is inchrded in originating content server, or in tire 
compnter of the revesting subscriber within tire access network i«se lf . to sfiU other 
cases, snch as peer to peer distribution of authored content, where content providers are 
not otherwise in control of dislribntion, the anmenfication mnction of block 3720 can be 
performed by an authentication server existing separate from tire access network, 
subsenber or content transmission server. These eases are discussed more fully below. 
Such an authentication server 3720 can be any type of authentication apparatus known in 
U,e „ including, by way of example only, a Rad.us server, Kerberos, RSA, Microsoft 
Passport, etc. 
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,0087] A now maintenance component 3725 is responsible for managing the flow table 
by modifying existing flow table entries that are no longer needed such as when a flow is 
no longer being used or the entry has been aged. Tha, flow maintenance component 3725 
also updates existing flows with any service changes. 

l0 088] A stgnature policy management block 3730 is responsible for configuring and 
managing preferred transport service associated with a flow tha, is bound to a signature, 
content tag or both. 

,00891 A signature and tag registration block 3740 allows trusted registration of 
signature and/or tag a. the preferred transporter by (i) an authorized content sending node 
such as an Interne, media service or sending application like a Internet telephony client; 
(ii) an authorized content originator such as a musician or video producer; (iii) any other 
trusted third party content owner or distributor. 

,0090) In this flow-based subsystem improved for use by the present invention, a 
server-based component provides the engine for service configuration and management 
togic Service Logtc Engine 3735 performs additional tasks that are unique for preferred 
transport. Those types of tasks include for example management, configuration and 
maintenance of signatures and tags within the preferred transport node. The server 
component, while shown as an externa, component from the Preferred Transporter, could 
be integrated into the Preferred Transporter or some other network element. 
(00911 FIG. 12 illustrates a functional block diagram of a hardware unplementation 
capable of unplementing the functions of the packet processor and switching fabric 3700 
ofFlG. 11. FIG. 13 illustratesaftllhardwareinstantiationofapreferred transporter 
apparatus capable of carrying out all of the program functions of FIG. 11. 
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(00921 In embodiments, a Preferred Transporter may be implemented in an 
embodiment that is no. flow-based, but still provide preferred transport to a series of 
packet transmissions. 

,00931 in one embodiment of the present invention, transmissions may be posrtively 
identified and authenticated by the sending node, for example, at the aceess provider 
level. 

,0094) In one embodiment providing this identification and anthentieation 
functionality, the present invention provides a method and apparatus to achieve a 
eompromise between the public's and content providers' need to distribute large files 
efficiently while compensating the broadband access providers for opening their plan, for 
this shared d,s.ribu.io„ task. Namely, .he present invention provides means for any entity 
sending content over me Internet, be it a central server or even an application such as a 
peer to peer program running a. a single subscriber's computer, to authenticate a. a 
preferred transporter. Based on policies or rules regarding oon.en. types, subscriber ID, 
application type, or any other parameter, such a preferred transporter would allocate 
proper transport. Proper tiansport might entail tailoring data ttansmission in any number 
of ways such aa by alleviating rate limits or byte caps, or even or even by offering burs, 
capacity for participating transmitters per prior agreement or special policy- 
[0095] The preferred transporter monitors those distribution events for purposes, 
among others, of accounting and receiving payment from sending entities or subscribers 
for that prenuum transport service. In a further embodiment, taugb, here is a system of 
tagging content for preferred transport purposes, such that content itself can be 
recognized by origin, authenticated regardless of sending entity. 
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,00,6, Under a further imp—on of the present invention, a preferred transporter 

amoun, of bandwidth avattabie to a subscriber, bu, on offering eertatn applications, 
nation aervicea, or sets of eonten, to subscribers on a M toe, periodic or as needed 
on-demand basis. Such tiered service can be offered to subscribers on any number of 
bases - such aa pay per use, month.y subscnption for specific transport parameters, 
introductory offers, bonus serv.ce for .oya. customers, differential service for 
subscribers bdongmg to certain netghborhoou or condo associations or outer groups, or 
any other basis. Atternativeiy, tiered serv.ce could be afforded for content or 
transmissions ffom centra, servers or by chent applications proliferated by content 
pmvtders w„h whom the access network has reached special business arrangements. 
,0097, Such a tiered service mode, pervades the provision of cab.e and subscription 
^vision. Tiering is by its very nature a way to maximize opportunities in an efficient 

Ms, access providers need a rename and veriliab.e way to identify parttctpating content 
« transmissions across their network facilities in order to provision appropriate 
connectivity. That same means could aUow .he broadband access provider to monitor 
and measure the transmission of tdentifted content and applications for the purposes of 
accounting with either the subscribers or the content providers paying for network 

W no. .united ,o con,en» attributes or tneta data, provides usage and consumption 
aeuvtty reports me can give va.uab.e marketing demographies .o or.gina.ing cottten. 



owners. 
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,0098, Specif**, in FIG. 1 1, a. signature policy management b.ock 3730, a preferred 
transporter maintains eontent nsage files stonng records of content transmission by 
content tag attribute, As described more fully below in (he discussion of content tag 
structure and parameters, those attrrbu.es can include any of.be foUowing among others: 
sending or requesting application, sendtng or requesting node, content Cass, content type, 
content instance, payment forms, copyright and license information. 
(0099) FIG. Hillustratesapathwayoftransmittingcontenttoanauthenticated 
subscriber or requesting app.ieation. Authentication can occtu between a subscriber's 
internet cot—cations node 9,0 and an access network's facilities 920. A preferred 
transporter 930 may identify traffic coming in from a content server Internet 
communications node 940 (likely outside of the broadband access provider's network), 
and offer it to subscribers authenticated for that content server node 930. 
101001 By enabling access providers to be the ones to control access to premium 
content, a more flexible "bundling" of servtces model, similar to that use in cable 
tension, avails. For example, an access provider can offer a variety of bundfed servtces 
enabled by .he prefetred transport of content. Similar to packaging various con.en. to 
provide entry-leve. plans for gaining new market penetration in basic cable TV packages, 
the access provider can offer an entry-level con.en, plan .ha. serves a new marke. 
demographic such as a music-only package or web, email, and music. An access provider 
can offer new con.en. sendees and bundles on top of the basic high-speed broadband 
Wemet access. In some instances, an access provider may offer new con.en. services on 
a pay-per-view (ppv) model, where individual con.en. or application is given preferred 
transport in conjunction with a financial transaction. If the access provider's fees include 
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usage fees, it may be desirable to exclude preferred transport ppv content from the 
monthly usage fees for basic access or fixed service plans. 

[0101] In FIG. 15, the entity being authenticated is not the subscriber's node, but the 
node 1110 content server outside of the access network being asked to send the preferred 
service content across the access network to a requesting subscriber node 1 120. This 
type of authentication and preferred transport is used, for example, when particular 
content classes or types may be restncted to certain applications or market demographics. 
A specific example entails the distribution of premium content over a peer-to-peer 
application. Without a preferred transport provisioning authentication of the content and 
its transport, subscriber node 1 120 could usurp the communication port and application 
signature to access the content. By authenticating at subscriber node 1 120 for content 
served from content server node 1110, premium content and its distribution is maintained 
at the access network even though the content is served outside the access provider 
control. Music distribution over a peer to peer network would benefit from this 
authentication and access network preferred transport. 

[0102] FIG. 10 illustrates divergent content transmission and authentication pathways. 
Before sending, or according preferred service, for a flow of broadband content, a 
preferred transporter 1010 might authenticate a content transmission request at a separate 
authentication node 1020. Having a separate authentication node associated with a 
specific content tag could allow content originators to control the exact consumption and 
transport distribution of every individual content item regardless of how it is distributed 
over a broadband network. In cases where content can be distributed outside the control 
of the content originator, content tags authenticated at the access provider network can in 



31 



this way regain control of the distribution under the authority of the originating content 
provider. This provides a hybrid model of allowing wide distribution of content while 
maintaining the content originator's control of how the content is delivered over the 
transport. A key business benefit enabled by the use of content tags at the access provider 
network is that it enables the access provider to collect market demographics and content 
class/type usage, activity, and distribution information that can guide the access provider 
to structure content offerings or select content partners. 

[0103] An example will further illustrate the mechanics of diverged content delivery 
and transmission node authentication through a preferred transport node under the present 
invention. In this example, the subscriber node 1120 of FIG. 15 is a broadband service 
subscriber's computer requesting content from an Internet Communication Node 1110 
which could be, for example, an online music service. A preferred transporter node 1 1 80 
is depicted as a switch operated by a cable modem broadband subscriber service which 
interconnects subscriber's with its facility via an access network 1135, with each cable 
modem connection terminating at a Cable Modem Termination Service ("CMTS") 1 140. 
[0104] The CMTS converts the cable infrastructure data payload to IP based packet 
services for transport over the Internet 1 160 through an Internet router 1 170 on the 
client's broadband access network and Internet router 1 140 on the server's broadband 
access network. The Internet 1 1 60 may be made up of multiple public networks or may 
be a private backbone of the service provider. The broadband service provider happens to 
have byte cap restrictions in place counting all bytes transmitted and received by the 
client node 1 120 and applying a cap on the number of bytes that can be transmitted or 
received within a monthly period. 
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,0,05) In this example, the subscriber has joined a subscription-based service with the 
onhne music service hosting the server node , 1 10 and for a month* subscription fee is 
entitled to unlimited downloads per month. 

10X06] A preferred transport systems according to one embodiment of the present 
invention cou.d aUow the subscriber with the monthly subscription service to enjoy faster 
downloads and unlimited music down.oad s without any byte cap reaction. Because of 
.his need and desire of both the serving entity and the subscriber to enjoy a monthly 
download service unencumbered by any byte cap restrictions, the entity hosting the music 
download service has agreed with the cable modem broadband subscription service to 
aUow preferred transport of music downloads ,o communication node 1 120. Under this 
agreement, the server node .110 and the Preferted Transporter node 1 180 of that 
hroadband access provrder can each be configured with a shared secret and a content 
appficafion suture. Furthermore, assume that the subscriber has agreed to pay the cable 
operator an extra $1 .00 per month for higher speed downloads and exclusion of music 
downloads from their monthly byte caps. 

,0,07] The client node 1 120 nans a client application allowing the subscriber to choose 
a music selection for download form the server node 11 10. This application can be a 
properly e,uipped web browser, media p.ayer, or another cfient app.ication tha, is open 
to carrymg content from multiple providers or dedicated to bringing service on.y from 
Una, online music service. The subscriber at chen. node 1 120 interactively selects a 
musi c download se.ectton and the server node 1 11 0 readies the music download for 
preferted transport by conforming to the agreed application signature and inserting a 
content tag. The content tag tdentifies the application, the content class and type, and the 
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preferred transport service (for example: exc.ude from byte oaps). The content tag is 
anthenticated using any a. least nnidirectiona. authentication technique (such as a CRC 
computation) and optionally a secret number shared between the servhrg entity and the 
eable operator. Once me content is readied, it is transmitted over me network comprised 
of cab.e modem 1,30, termination system , HO, .n.ernet access router U40, the Interne. 
,160, Interne, access router 1 1 70 where it U received by the preferred transporter 1 1 80. 
Upon receiving the content payload with its signature and content tag, the preferred 
transport 1.80 inspects the content .ag and computes the authenticated va.ue inside the 
,ag using (in .his example) me CRC and shared secret Once successful, Ore preferred 
transporter , . 80 sets up a switching flow table .0 provtde me preferred transport service 
of high bandwidth and exchtsion from counting any downloaded by.es .oward .he 
operator byte caps. The preferred transporter can also enforce genera, access network 
policies - such as the policy flta, mis type of preferred transport only applies to .he 
download music flows. The prefemed transporter , , 80 switches fine music dowmoad 
flows with preferred transport for the duration of the music dowmoad between the Cent 
node 1 120 and the server node 1110. 

(0,081 Embodiments of fine present invention use content tags associated with data 
packets. FIG. 17 teaches one form of a content tag snucture that can be embedded as part 
of a Chen, node application signature, for example, inside the content payload header, or 
associated on a con.en, server as a preferred transport descriptor. In ttris tag s.ruc.ure, a 
ntarker 170 can be used to identify the location of the tag in the packet transmission 
pay,oad, fottowed by a lengttr descriptor 172 and a version number ,74. The ,eng«h 
descriptor 172 can be used to instruct .he preferred transporter how many bits in ttre 
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authenticate its use. Other tag structures are possible. 
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represents. In sneh an embodiment, the tag can contain a version nnmber and reserved 
fields along with a digital signature used to authenticate its use. 
pilll FIG. 18 illustrates one embodiment of a content authentication tag structure in 
aecordance with the present mvention. The tag includes the fields tag ID 180, which is a 
well-known tag identifier indicating me type of tag used; tag length .82, whrch indicates 
the remaining length of the tag; tag version 184, which indicates the version of the tag 
structure being used; transport service .86, which is a bit mask indicating which transport 
service preferences are to be enabled; authenticated transport 188, which is a digital 
signature used to authenticate the preferred transport; content class/type 190, which 
contains the OID syntax from a content class naming tree and indicates the content type; 
content application 192, which contains the OID syntax fiom an application naming tree 
and indicates the application of the content; content originator 194, which contains the 
OID syntax from a content originator naming tree and indicates tire originator of the 
content; content metadata 196, which contains the OBO syntax from a Content Meta Data 
naming tree and indicates meta data, and authentication URL 198, which contains the 
URL of the authentication server. Other types of tags containing one or more of these 
and other fields will be apparent to those skilled irr the art. 

[0112) one embodiment envisions the transport tags being appended to a file request 
using the HTTP protocol. Another envisions the transport tags being advertised in a 
mamrer similar to a .ease query in the Internet Domain Name Service. Ye, another 
envisions a content tag distribution protocol wherein all Preferred Transport nodes 
communicate their know.edge of content tags and usage. For example, known in the art is 
a tag distribution protocol used by Multi-Ptotocol-Layer-Switches ("MPLS") to associate 
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protocol tags with reserved paths in the network. Sueh a mechanism eouid preferably 
result in a worldwide eontent distribution system providing preferred transport at the 
access provider ye. leave con.ro. of content distribution in the hands of content 
orig.na.ors. This embodiment envisions expanding or extending Cher attributes to the 
conten. tags for .he control and monitoring of conten. distribution. For example, such 
extensions could implement reactions agains. file sharing, or place limitattons on me 
exercise of copyrights owned by content originators. 

[0113] Copyright control .ag extensions could mirror me righ.s ft* content originators 
are granted under intemationa! copyrigh. and re.ated or neighboring laws. Generally, 
.hose rights include .he right to (i) reproduce copies; (ii) distribute copies; (hi) prepare 
derivative works; (iv) pub.icly perform (in .he case primarily of musical works or sound 
recordings); or (v) publicly display (primarily in .he case of pictorial or audiov,sua> 
works). Additionally, fields could optionally be included in the tags covering other 
in.ema.iona!, nationa. or local rights affecting the reproduction, distribution, modification 
or other exploitation of original works. For example, the tag can contain parameters 
governing user's ability to modify conten. under European "moral rights" or so-called 
"droit moral." Certain jurisdictions also allow restrictions on the reproduction, use or 
modification of dalabases, particularly customer information databases. All of these 
rights, and licenses modifying these rights, belonging to content originators can be 
described by additional fields witter the content tags of the present invention. 
Accordingly, all instructions in conten, tags can he identified by any authenticated or 
trusted node in the network including the preferred transporter. Then, any of the nodes 
interpreting those tags can instruct the preferred transporter to implement transport 
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according to the limitations or strictures indicated in those tags. In one embodiment, a 
preferred transporter can count copyright protected content as it enters and exits the 
network. Th,s information can be used, for example, to enforce a "levy" tax .ha. service 
providers would pay in order to cany peer-.o-peer file sharing or broadband services. 
,0! 14] A digUal signature of a tag or for signature recognition can be computed in any 
agreed manner bu. in mis example is computed using a cyclic redundancy check (CRC) 
32 polynomial with a shared secret (such as a prime number) as a seed value. In this 
example, CRC enables functional compulation of a 1 -way authentication value. Once .he 
content tag is authenticated, then variable length Object Identifiers can be used to 
descrtbe the content application, class, originator, and metadata. Each Object Identifier 
uses a tag/length/value encoding that is wel. taught in SNMP Management Information 
Base and ASN.l BER (Basic Encoding Rules). Using Object Identifiers allows an 
arbitrary naming tree to exist to describe the content application, class, type, and 
originator without having to redefine the tag structure encoding each time a new content 
application, Cass, type, or originator is added. Because Object Identifies are machine 
readable, the Preferred Transporter can keep statistics on each of the unique values it 
encounters in each of «hese content tag field, For example, a Preferred Transport could 
count statistics for music content from Sony Records, regardless of artist or location. 
Sony in turn could receive usage reports form various access providers to obtain key 
usage distribution information from geographically disperse locations and to determine 
possrble carriage fees. It is likely that access providers will become distributors of digital 
content, committing bandwidth, resources, and access .o subscribers in return for carriage 
distribution fees. 
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,01 151 Any time a preferred transporter encounters a content tag, it can use the 
information indicated by the tag to decode and interpret the content being transported or 
requested without having to examine deeply into the actual file content or packet transfer. 
The content originator or the content requestor can assign elements of the tag values 
depending upon its control of the preferred transport content. In its simplest use, the 
content tag can be a marker inside an application payload that cames authentication 
information for preferred transport. In a more robust use, Are content tag can identify the 
originating content, i. class and type according to the hierarchy and formats of the content 
originator. Tins is important because content names and keywords can be modified but 
the content tag remains authenticated against the original content descriptors. Content 
names and keywords can be changed by various users or servers encountering content in 
the stream of distribution. 

[0116] Now we explore methods under the present invention for an access provider 
positively to identify or authenticate transmissions by sending node, and establish 
preferred transport flows. 

10117] In each of these methods, the sending node and the preferred transporter initially 
"register" with each other, that is, each accept and store the transport parameters which 
the preferred transporter is to allocate to each relevant transmission type that the sending 
node transmits. That is, each of these methods assumes that the sending node and the 
preferred transporter have each stored and are equipped to recogmze agreed preferred 
transport parameters prior to any transmission, Then, each transmission is preceded by 
the sending of a signature alerting the preferred transporter to adhere to that prior 
registered arrangement. 



39 



|01181 FIG 19 iUus.rates.h.sregis.raUon/signa.ure method. A preferred transport 
signa »u r e affords derated — « for —annus preference. A.SO, under this 

each mdtvidual transmission, instead of every —ion from a gtven sender or 

, on91 Parameters tha, can be made avai.ab.e for inclusion in a preferred transport 

signature under the present invention include: 

. up to subscriber, max bandwidth or up to the maximum transmission speed of 
the access provider netwo*. For example, a subscnber may be prov,s,oned for 
,28Kbps upstream and 384Kb P s downstream as part of the basic service. A 
pr eferredtr»spo rt could increase the emission speeds above thishasic rate for 
the duration of a preferred content instance. 



per 



, Query subscnber if higher bandwidth desired. For example, as par. of a "pay 

- type transaction or an on-demand content se.ection, me subscriber may 
Coose to increase the transmission speeds for me duration of me content 
de.ivery. This cou.d enable high quality for a streaming service or a faster 
download of a large movie file. 

. R „„ te to alternative dehvery for subscriber. For exampie, an httemet video 

. Reiease date. For examp.e, a studio cou,d pre-distnhute content in preparation for 
to the subscribers before the date indicated. 



40 



,0120, The prior arrangement to be registered by a eontent server with a preferred 
transporter in these exanrp.es ean be seconding to any nnmber of business or practical 
arrangements from idiosyncratic to broad industry standard. In one embodiment, both the 
signature template and the transmission types and parameters are a wholly private 
arrangement between a single content provider and a broadband access network provider. 
For example, a provider of on-demand video via public network could make a private 
arrangement to transport video content to an MSG via the Internet according to a pre- 
revered signature arrangement. In that examp.e, a preferred transporter would receive 
and recognize the signature of pay.oads sen. by the on-demand video provider, accord 
special type of connectivity, and shun, the emissions to a subscriber's digital set top 
box attached to her home television rather than to their Internet client computer. 
,0121, In another embodiment, an industry standard prior registration process and 
signature forma, could be es.ablished, for example, by an industry standards body formed 
by any combination of broadband access providers, preferred transport equipment and 
servtce vendors, and content companies. In ye. anotirer embodiment, a vendor of 
preferred transport equipment or services could establish a proprietary registration system 
and signature fonrra<s such .ha. any content provider could easily register for preferred 
transport over btoadband access networks using tire equipment or service offerings of that 
preferred transport vendor. 

[0122] Referring to the network block diagram at the top of each of FIGS. 19-24: 
[0123] A content server node 1 500 is a storage device coupled to a digital network 
communications device for transmitting items of digital content upon request. Normally, 
this can be a computer 300 of the type illustrated in FIG. 3, storing and operating a 
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network server or client application such as a media server, an Internet telephony 
application, an instant messaging program, or any other. In a client-server embodiment, 
this content server node 1500 can be large-scale streaming media or media download 
server. Or in a peer-to-peer scenario, this can be any user's computer or a supernode that 
both receives and stores, and retrieves and sends files according to requests by other 
peers. In a consumer broadband application, this can be any user's computer operating 
an application that is registered with the preferred transporter for special treatment. 
Examples can include Internet telephony, collaboration software, or remote computer 
access. While these FIGS. 19-24 illustrate node authentication by showing a content 
server outside of the broadband access network being afforded preferred transport to 
client nodes inside of that network, the content server node 1500 can also be at a 
subscriber inside of the broadband access network. 

[0124] In each of FIGS. 19-24, the content server node 1500 communicates via a wide 
area network such as the Internet at 1510, interconnected to a broadband access 
provider's backbone at 1520, routing all transmission requests or alternatively the 
transmissions themselves through a preferred transporter 1530. When the preferred 
transporter identifies or authenticates properly registered and signed flows, it transmits 
them through a broadband access provider's network 1540 to a subscriber's client node 
1 560 via a broadband modem 1 550 coupled to that client node. In one embodiment, the 
client node 1560 can be or include a computer 300 of the type described in FIG. 3. In 
other embodiments, the client node 1 560 can be or include an IP telephone or 
videophone, a videogame machine, a television, a personal video recorder, a digital set 
top box of the type used to receive video-on-demand programming, or other systems. 
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,01251 While FIG. 19 illustrates the basic prior registration followed by apriori 
signatures at eaeh transmission, FIGS. 20 and 21 also illustrate authentication steps to 
ensure the security of preferred transport resources. Without these steps, any non- 
participating content server node rha, is privy ,0 the signature structure of another 
properly registered content serve, could, for example, tmmic those signatures, and gam 
preferred treafrnen, a, the preferred transporter into the broadband access network. 
,0,261 Turning to the step by step process by which registration, signature, and 
preferred transport can be executed under a simple embodiment of me present invention, 
FIG. 19 illustrates a square only method, wbere no authentication security steps are 
taken. A. step 1565 the content server node 1500 and the preferred transporter 1 530 each 
store an agreed se, of parameters for stature format and eventual treatment of various 
eontent or transmission types and classes intending to he sen, by tire content serve, 
,0,271 That signature can include a structured content tag descriptor, such as, for 
example, the content tag of FIG. 17, that contains machine-readable metadata about the 
content as well as the content originator and preferred bansport service requirements. A 
eontent tag structure is a convenient way to implement these dehors for use m 
preferred transport because i, enables the preferred transporter to identify signatures for 
prefer, transport by inspecting packet payload requests or transmissions for the tag, 

m ^tire mcketized payloads in mid-transmission through the 
rather than having to inspect entire pactetizeo payiu 

access provider's core. 

,0,281 Oneaspectofacontenttagforpreferredtransportundermepresentinvention 
anows comp,ex arrangements ,0 be represented in a simple machine-readable tag that can 
he bound directly in from of content or can exist separately from the content, perhaps in a 
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request for content or in any other signaling message not directly coupled to the content 
transmission. For example, that could be a message from a media player requesting that 
a video stream commence, wherein the video stream itself is not tagged, but that message 
is tagged to request authenticated preferred transport for the duration of that stream. That 
"arrangement" can be set by human interaction, or by automated form, with the preferred 
transporter sending a machine or human actionable registration invitation to new content 
servers that it encounters. 

[0129] A content tag, such as the content tag depicted in FIG. 17, can be embedded as 
part of a client node application signature, inside the content payload header, or 
associated on a content server as a preferred transport descriptor. In this tag structure, a 
marker can be used to identify the location of the tag in the packet transmission payload, 
followed by a length descriptor and a version number. The length can be used to instruct 
the preferred transporter how many bits in the transmission payload to extract as the 
content tag. Once the content tag is extracted, it can be inspected and used to affect the 
transmission, delivery, metering, accounting, and service of the content it describes or 
represents. In such an embodiment, the tag can contain a version number and reserved 
fields along with a digital signature used to authenticate its use. 
[0130] One embodiment envisions the transport tags being appended to a file request 
using the HTTP protocol. Another envisions the transport tags being advertised in a 
manner similar to a lease query in the Internet Domain Name Service. Yet another 
envisions a content tag distribution protocol wherein all Preferred Transport nodes 
communicate their knowledge of content tags and usage. For example, known in the art is 
a tag distribution protocol used by MuM-Protocol-Layer- Switches ("MPLS") to associate 
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protocol tags with reserved paths in the network. Such a mechanism could preferably 
result in a worldwide content distribution system providing preferred transport at the 
access provider yet leave control of content distribution in the hands of content 
originators. This embodiment envisions expanding or extending other attributes to the 
content tags for the control and monitoring of content distnbution. For example, such 
extensions could implement restrictions against file sharing, or place limitations on the 
exercise of copyrights owned by content originators. 

[0131] Copyright control tag extensions could mirror the rights that content originators 
are granted under international copyright and related or neighboring laws. Generally, 
those rights include the right to (i) reproduce copies; (ii) distribute copies; (Hi) prepare 
derivative works; (iv) publicly perform (in the case primarily of musical works or sound 
recordings); or (v) publicly display (primarily in the case of pictorial or audiovisual 
works). Additionally, fields could optionally be included in the tags covering other 
international, national or local rights affecting the reproduction, distribution, modification 
or other exploitation of original works. For example, the tag can contain parameters 
governing user's ability to modify content under European "moral rights" or so-called 
"droit moral." Certain jurisdictions also allow restrictions on the reproduction, use or 
modification of databases, particularly customer information databases. All of these 
rights, and licenses modifying these rights, belonging to content originators can be 
described by additional fields within the content tags of the present invention. 
Accordingly, all instructions in content tags can be identified by any authenticated or 
trusted node in the network including the preferred transporter. Then, any of the nodes 
interpreting those tags can instruct the preferred transporter to implement transport 
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according to the limitations or strictures indicated in those tags. In one embodiment, a 
preferred transporter can count copyright protected content as it enters and exits the 
network. This information can be used, for example, to enforce a "levy" tax that service 
providers would pay in order to carry peer-to-peer file sharing or broadband services. 
10132] A digital signature of a tag or for signature recognition can be computed in any 
agreed manner but in this example is computed using a cyclic redundancy check (CRC) 
32 polynomial with a shared secret (such as a prime number) as a seed value. In this 
example, CRC enables functional computation of a 1-way authentication value. Once the 
content tag is authenticated, then variable length Object Identifiers can be used to 
describe the content application, class, originator, and metadata. Each Object Identifier 
uses a tag/length/value encoding that is well taught in SNMP Management Information 
Base and ASN.l BER (Basic Encoding Rules). Using Object Identifiers allows an 
arbitrary naming tree to exist to describe the content application, class, type, and 
originator without having to redefine the tag structure encoding each time a new content 
application, class, type, or originator is added. Because Object Identifies are machine 
readable, the Preferred Transporter can keep statistics on each of the unique values it 
encounters in each of these content tag fields. For example, a Preferred Transport could 
count statistics for music content from Sony Records, regardless of artist or location. 
Sony in turn could receive usage reports form various access providers to obtain key 
usage distribution information from geographically disperse locations and to determine 
possible carriage fees. It is likely that access providers will become distributors of digital 
content, committing bandwidth, resources, and access to subscribers in return for carriage 
distribution fees. 
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10133] Any time a preferred transporter encounters a eontent tag, it can use the 
information indicated by the tag to decode and interpret the content being transported or 
jested without having to examine deeply mto fine actual file content or packet transfer. 
The content originator or the content requestor can assign elements of the tag values 
depending upon its control of the preferred transport content. In its simplest use, the 
content tag can be a marker inside an application payload that carties authentication 
information for preferred transport. In a more robust use, the content hag can identify the 
originating content, it Cass and type according to the hierarchy and formats of the content 
originator. This is important because content names and keywords can be modified bu, 
the content tag remains authenticated against the original content descriptors. Content 
names and keywords can be changed by various users or servers encountering content in 
the stream of distribution. 

[0134] Once the content server and preferred transporter agree on signature format and 
parameters to include in signature, each stores that information at step 1 570 for reference 
each time the content server 1500 initiates a signed content transmission. 
[0135] To initiate a signed content transmission for preferred transport, at step 1575, 
content server 1500 can initiate transmission of a signature bearing the transport 
parameters for a transmission payload. That signature can be sent as a separate 
preliminary step, or can be coupled to the payload at the beginning of transmission. At 
step 1580, the preferred transporter 1530 can inspect that signature (whether sent 
separately or coupled to the payload). That preferred transporter can determine whether 
the signature is valid. If so, then at step 1585 that preferred transporter either can 
message that content server or can allow that content server to continue an active 
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transmission so that the transmission can commence or proceed at step 1590, with that 
preferred transporter adhering to the transport means indicated by the values inspected in 
the signature. 

[0136] If the signature is not valid, or if no signature is present, then the preferred 
transporter can reject the payload for preferred transport at step 1 595. The result is that 
the preferred transporter would not accord that payload preferred transport. As an 
example, here are some of the types of transport that a preferred transporter may accord a 
non-signed payload, or a payload with a rejected signature: 

[0137] Do not transmit. This prevents any content distribution from occurring on the 
inspected communication port. 

[0138] Transmit according to default, non-preferred parameters. Allows content 
distribution but with no preference. 

[0139] Send client node 1560 or content server node 1500 an opportunity to send that 
payload using preferred transport. 

[0140] Send client node 1560 or content server node 1500 an opportunity to send 
payloads of that type, class, origin, or all payloads from that sender with preferred 
transport. This request may or may not require either of those nodes to pay or give other 
consideration in the bargain. 

[0141] FIG 1 9a is a flow chart depicting a preferred transporter method for providing 
preferred transport in accordance with FIG 19. The preferred transporter receives a 
packet in content transmission 1591 and determines whether the signature is registered 
1592. If the signature is not registered, the packet will be accorded standard transport 
1596. If the signature is registered, the preferred transporter retrieves the transport 
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profile 1593, for example, from a database of signatures and transport profiles 1594. The 
packet is then accorded preferred transport 1595 according to the transport profile. 
[0142] FIG. 20 adds the element of security to a registration and signature process, by 
use of a one-way transmission and venfication of a shared secret. In one embodiment, a 
cyclical redundancy check (CRC) method of using a shared secret is used for one-way 
authentication. Any number of other methods of one-way cryptography are also 
available in the art to protect the privileged status of the contents of a payload signature. 
The steps are similar to those of FIG 19, except that a shared secret is introduced into the 
agreed parameters, and used to encrypt the signature itself. As long as the shared secret 
is kept secure, such signature encryption method is designed to prevent a non-regxstered 
content server from using a signature configured as though it were registered, and 
spoofing the preferred transporter into wrongfully according a payload preferred 
transport. 

[01431 FIG 20a is a flowchart depicting a preferred transporter method for providing 
preferred transport in accordance with FIG 20. The preferred transporter receives a 
request for preferred transport 1691 and determines whether the port is registered 1692. 
If the port is not registered, a packet will be accorded standard transport 1699. If the port 
is registered, the preferred transporter determines whether the packet is encrypted 1693. 
If the packet is not encrypted, the packet will be accorded standard transport 1699. If the 
packet is encrypted, the preferred transporter decrypts the payload signature and 
determines whether the signature is valid 1695. If the signature is not valid, the packet is 
accorded standard transport 1699. If the signature is valid, the preferred transporter 
retrieves the transport profile for the signature 1696, for example, from a database of 
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signatures and transport profiles 1697. The packet is then accorded preferred transport 
1698 according to the transport profile. 

[0144] An example will further illustrate the mechanics of a client application 
registering its signature and tag authentication type. Being able to register a signature and 
authentication type allows an application dynamically to associate preferred transport 
with certain application and content requests. By way of example, let us assume that 
Client Node 1 560 is used by a subscriber for peer to peer file sharing. One of the peer to 
peer applications provides access to authorized copyrighted content which is digitally 
signed and shared amongst the server nodes within a peer to peer network. Content 
Server 1 500 in this case is actually a peer node or a peer supemode as explained above, 
which stores such authorized, digitally signed copyrighted files and makes them available 
for authorized downloads. Further assume that this peer to peer application supports 
content tags under the present invention that are readable by a Preferred Transporter 1530 
in the access provider network. 

[0145] In this example, as is increasingly the case in the broadband access network 
field, the access network operator in its service agreement with every subscriber prohibits 
the use of peer to peer applications for the transfer of unauthorized or pirated content. 
The one exception are certain peer to peer networks to the extent that they offer content 
files that are tagged as authorized under the content tag structure honored by that access 
provider's preferred transporter 1530. For tagged, authenticated files, the broadband 
access providers actually offers preferred transport in exchange for one time transport 
fees per download or additional monthly service fees paid by the subscriber. 
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[0146] Referring to FIG 21, the subscriber at Client Node 1560 downloads and installs 
a peer to peer file sharing application that integrates with the content tag system of the 
access provider's preferred transporter 1530. This is the latest revision of application 
code. Upon installation, the file sharing application registers itself with the Preferred 
Transport 1530 node by way of the Preferred Transport's Authentication Server 1700 as 
shown in step 1710. 

[0147] The Authentication Server 1700 can authenticate the application and stores the 
signature and authentication parameters by creating a profile and then loading the profile 
in to the Preferred Transporter 1530 as shown in step 1730. Those parameters can 
include instructions for authenticating content transmission to or from that peer 
application. Examples of those parameters include without limitation, URLs of any 
authentication servers, application OID, tag parameters or locations of authentication 
values stored within tags, private or public keys if the authentication is to be by two-way 
key exchange, cryptograms if the authentication is to be by one way encryption using a 
shared secret stored at the Preferred Transporter 1530 and the Authentication Server 
1700, or any other type of parameters required by any communications node to perform 
authentication of content for preferred transport. Note that the shared secret can be 
unique to each instance of the application. Also note that once an application has itself 
been authenticated to an authentication server by any means including for example 
username and password, then the shared secret can be restricted from the client and 
known only to the Preferred Transporter 1530 and the Authentication Server 1700. In 
any event, desired is a means of establishing an authenticated communications path 
among the client application at client node 1560, the Preferred Transporter 1530 and the 
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Authentication Server 1700 such that system is not vulnerable to attack at the client level. 
Therefore optimally, the client application at client node 1560 would store no unchanging 
secret key information. 

[0148] Now the Client Node 1 560 peer to peer application can request content from a 
Peer Node 1 500 using that application's registered signature and authenticated tag as 
shown in step 1740. The Preferred Transporter can recognize the application signature 
and extract the content tag to compute the authenticated value using a shared secret and 
the registered information as shown in step 1750. If the authentication is successful, then 
the Preferred Transporter can provide preferred transport services for the duration of the 
content flow as shown in step 1760 with the client application able to receive peer to peer 
shared files as shown in step 1770 otherwise the sharing is blocked as shown in step 
1780. 

[0149] FIG 21 a is a flowchart depicting a preferred transporter method for providing 
preferred transport in accordance FIG 21. The preferred transporter receives a packet in 
content transmission 1791 and determines whether the signature is registered 1792. If the 
signature is not registered, the packet will be accorded standard transport 1799. If the 
signature is registered, the preferred transporter determines whether the packet contains 
an authentication tag 1793. If the packet does not contain an authentication tag, the 
packet will be accorded standard transport 1799. If the packet does contain an 
authentication tag, the preferred transporter decrypts the authentication tag and 
determines whether the authentication is valid 1795. If the authentication is not valid, the 
packet is accorded standard transport 1799. If the authentication is valid, the preferred 
transporter retrieves the transport profile 1 796, for example, from a database of signatures 
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and transport profiles 1797. The packet is then accorded preferred transport 1798 
according to the transport profile. 

[0150] There may be times when it will be more effective to practice the present 
invention by having an application at the client node 1560 actually carry out the 
authentication for preferred transport of content from a content server node 1500. One 
example of this is when a client node is used for two way communications service like 
Internet telephony, or multiplayer gaming. In those cases, the subscriber's own client 
node 1560 may actually be the content sending node, or may function as both a content 
sending node and a client node. Another example of a client node also being a content 
server node is when a client node is operating a peer to peer content distribution 
application. And generally, for those and almost any other transmission situation, a 
network access provider may reduce the burden on its facility by deferring the preferred 
transport authentication role to an application running at the client node. Such an 
embodiment of the present invention is available to reduce computational and traffic 
burdens placed on a central preferred transporter. That outsourcing is achieved by having 
the preferred transport signatures or tags sent by the client when requesting the download, 
rather than unpacking it from the payload itself in mid transmission. 
[0151] FIG. 22 illustrates such a process. Note that the illustrated embodiment is a 
hybrid of a node-specific authentication for preferred transport and a content specific 
process. This process is node-specific in the sense that it is an identification and 
authentication process available only to a client node within the broadband access 
network. But in the sense that the preferred transporter and the broadband access 
network provider controls all network access afforded to these nodes, this identification 
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and authentication scheme can be used for all broadband content requests from that client 
on an apriori basis. Therefore this figure describes the process by referencing use of a 
content tag as described in the node-agnostic/content-specific embodiment of the 
following section. 

[0152] FIG 22a is a flowchart depicting a method for providing preferred transport in 
accordance with FIG 22. The content server receives request for content from a client 
2790 and determines whether the content is associated with tags 2791. If the content is 
not associated with one or more tags, the content will be accorded standard transport 
2799. If the content is associated with one or more tags, the content server retrieves the 
tags, for example, from a database of content files and tags 2793. The content server then 
determines whether the content tag contains an authentication URL 2794. If the content 
tag does not contain an authentication URL, the content will be accorded standard 
transport 2799. If the content tag does contain an authentication URL, the preferred 
transporter requests authentication from the authentication URL 2795 and determines 
whether the authentication is valid 2796. If the authentication is valid, the content server 
permits the file request 2798. If the authentication is not valid, the content server denies 
the file request 2797. 

[0153] The process of FIG. 23 also refers to a client application being present in the 
client node 1 560. This can be an application placed at all client nodes by the broadband 
access provider itself in order to distnbute the task of authenticating content for preferred 
transport. Alternatively, it can be an application created by a participating software 
provider such as an Internet telephone or videoconference service, a multiparty gaming 
service, or even a peer to peer authorized content distribution network. This function of 
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authenticating for preferred transport by the participating access provider could be 
included in virtually any network client application that is intended to receive preferred 
transport by the access provider. Conversely, this function could be included in all 
versions of an Internet client application such as a peer to peer application. Only access 
providers running preferred transporters configured under the present invention to carry 
out the authentication and preferred transport steps would utilize the authentication or 
transport tags transmitted by that function at the client node level. Preferably such a 
function would be appended to the Internet application in such a way as not to adversely 
impact the application's size or functionality. 

[0154] At step 2610, a content server (or another communications client) can be ready 
to send certain content upon request. At step 2620, before sending any transmission 
requests, the client application at client 1560 and the preferred transporter 1530 might 
agree on signature or tag formats, preferred transport parameters for content or 
transmission classes and types, and on any one-way shared secret, or dynamic real time 
authentication processes or authentication URLs that must be consulted for each 
transmission. Normally, in a situation when many clients within the access network are 
running the same application, this might only entail the application at client node 1560 
registering with the preferred transporter 1530 for a set of those parameters already stored 
at the preferred transporter 1530. 

[0155] Step 2620 is the client's request for a download or communication with the 
content server 1500. One efficiency offered by this embodiment of the present invention 
is that the content signature or content tag may be offered to the preferred transporter in a 
separate step from the content transmission itself. This approach might spare preferred 
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transporter the complexity of stripping a signature or tag from the content payload itself, 
or even interrupting a transmission flow while any authentication is carried out. In the 
case of most broadband content requests, this request could be phrased as an HTTP GET 
request command. So even in the absence of any other signaling to alert the preferred 
transporter of a preferred transport request, the preferred transporter can inspect HTTP 
GET request, commands sent by the participating applications at participating subscribers 
and inspect that line for content tags or instructions. It is envisioned that a content tag 
could also be inserted in the response to the HTTP GET request. In some cases, it may be 
desirable to identify the returning path for preferred content in cases of asymmetrical 
routing. 

[0156] The participating application at client node 1 560 sends such a request at step 
2630. At step 2640, the preferred transporter 1530 inspects the tag, carrying out any 
authentication steps that are indicated within that tag, accepting or rejecting preferred 
transport accordingly at 2650 and 2660. So the preferred transport levels are fixed at the 
time that the content is requested. Then from the outset, the preferred transporter 
establishes the flow of the requested transmission according to the agreed and 
authenticated parameters. 

[0157] FIG 23a is a flowchart depicting a method for providing preferred transport in 
accordance with FIG 23. The preferred transporter receives request for content from a 
client 2691 and determines whether the request header contains a tag 2692. If the request 
header does not contain a tag, the content will be accorded standard transport 2699. If the 
request header contains a tag, the preferred transporter then determines whether the tag 
includes an authentication tag 2693. If the tag does not include an authentication tag, the 
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content will be accorded standard transport 2699. If the content tag does include an 
authentication tag, the preferred transporter decrypts the authentication tag 2694 and 
determines whether the authentication is valid 2695. If the authentication is not valid, the 
content is accorded standard transport 2699. If the authentication is valid, the preferred 
transporter retrieves the transfer profile for the signature 2696, for example, from a 
database of signatures and transport profiles 2697. The content is then accorded 
preferred transport 2698. 

[0158] One embodiment of the invention provides for sending-node-agnostic 
authentication of tagged content for preferred transport. This functionality will now be 
described with reference to FIGS. 22 and 24. 

[0159] Very often as content files begin to circulate among users of the Internet, they 
are transmitted by any number of transmission nodes that may or may not be controlled 
or related to their originator. For example, a single audio or visual file, even if it is 
properly protected against copying by digital rights management systems (like that 
offered by RealPlayer or Microsoft Media Player 9) will largely not actually be 
distributed by its originator. For example, the originator of a digitally protected song or 
video may first offer the file from download from its own server. In this scenario, a 
registration scheme for node-specific identification of content for preferred transport is 
adequate, since a special arrangement can be registered between that content server and 
any relevant preferred transporter. 

[0160] However, as the file becomes popular, it may end up being distributed by any 
number of means over the Internet. Users may share the file using peer to peer networks. 
They may e-mail or FTP it to each other. Different fan websites may post it for 
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download. Even access and network providers may cache the He so that subscribers can 
download it without taxing the network's Interne, backbone too heavily. In any of those 
redistribution scenarios, a preferred transport registration and identification system that 
works only with the original content server will no. recognize the file for preferred 
transport. 

[0161] A content-specific/node-agnostic embodiment of the present invention 
addresses this issue by offering different exemplary means of tagging a file itself for 
preferred transport. The tag can be coupled to the file in such a way as to be inseparable 
from it, instructing redistributors or preferred transporters in mid-transmission to accord 
the file preferred transport. Known in the art are methods of encrypting or protecting 
content files with so-called "digital rights management" to prevent unauthorized 
reproduction of copyrighted files. Those prior art DRM systems were limited to 
allowing originators to control only the manner in which their original content files were 
reproduced. Under the present invention, those same types of content protection tools 
can be used to insert tags (either encrypted or not) into content files to prevent or manage 
unauthorized distribution. Those same transport tags under the present invention may be 
used in other cases to encourage preferred transport or distribution of the content files. 
Either way, by marking the content when it is originated or DRM "wrapped," with the 
information needed by a preferred transporter, the present invention offers an originator 
of content to control not only the means by which that content is reproduced, but the 
means by which it is distributed. 

[0162] Generally, two different approaches to interpreting and enforcing node-agnostic 
content distribution possible can be explained. First, a content server used for content 
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redistribution can inspect a standard tag for authentication and preferred transport 
instructions. The content server would be the one to authenticate the content, preferably 
by real-time communications with an authentication server whose address is indicated by 
the content tag. Once authenticated, the content server could transmit it to the preferred 
transporter and the subscriber via a broadband access network (See FIG. 22), using any of 
the previously described node-specific methods. A content server node may be in a better 
network location to provide the preferred transport authentication in cases where the 
server is connected via a private circuit, a tunneling mechanism, or physically closest to 
the subscriber in the case of a content server cache. 

[0163] Second, a preferred transporter itself can inspect each payload before 
commencing a flow to a subscriber for content tags (See FIG. 24). Inspecting the content 
tag, the preferred transporter would send a real-time authentication request to any 
authentication server indicated in the tag, and if valid will flow the file to the subscriber 
based on the transport parameters indicated by the tag. 

[0164] In the same way Internet nodes provide hop-by-hop transport through a public 
and private network, content transport tags can be used to enable content distribution 
control over both public and private networks. A content tag could include scope or 
geographic restrictions. Secure content could be restricted not to exit a private network, 
or perhaps not lease the domestic territory. One embodiment of the tag could add a hop- 
count, use-count, or geographical constraint (inclusive, exclusive, or explicitly listed) 
descriptors, which could control the distribution of an individual content once it leaves 
the originating server. For example, a content tag could contain additional attributes 
restricting content distribution. That restriction could limit distribution based on 
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attributes including but not limited to physical location, geographic location, receiving 
applications, certain subscriber networks, certain subscribers, certain groups of 
subscribers or payment. 

[0165] An example will further illustrate the mechanics of a preferred transporter first 
authenticating an item of content for transmission, and then provisioning preferred 
transport according to an arrangement between the network access provider and an entity 
that originated or owns the content, but which may not be related to the content server 
now transmitting that content. There are any number of ways of establishing this 
arrangement between the network access provider and the content originator, either 
through human interaction, or various levels of automated or computer-negotiated 
arrangements. But assume that the arrangement of this example is reached by a cable 
operator entering into a business arrangement to provide preferred transport for all 
content being served from a particular content originator, such as a movie studio 
originating movies for download through a variety of online download services, or with a 
peer to peer network planned for legal content. 

[01 66] In FIG. 22, the Client Node 1 560 is a subscriber-operated computer requesting 
content from a Content Server Node 1500 hosting the movie downloads. The Content 
Server Node 1500 hosts a variety of video content files from different content originators, 
such as movie studios and sports entertainment. Not all video streams require preferred 
transport nor are all content originators willing to share revenues of video content with an 
access provider in order to receive preferred transport services of content. Consider for 
illustration that some content downloads will be authenticated for preferred transport and 
others will not. 
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[0167] The client node 1560 is connected to MSO broadband access network 1540 of a 
cable company. The cable infrastructure provides broadband Internet high-speed data 
service through a cable modem 1 550 which is connected via the MSO's cable lines to a 
separate Cable Modem Termination System in 1540. The cable termination systems 
convert the cable infrastructure data payload to IP based packet services for transport 
over the Internet 1510 through an Internet access router 1520 on the client's broadband 
access network. The Internet 1500 may be made up of multiple public networks or may 
be a private backbone of the service provider. This MSO broadband access provider may 
have imposed bandwidth restrictions on content downloads preventing broadcast quality, 
or fast download service unless the transmission is authenticated with a business 
contractor of the cable operator. Let us further assume that the cable operator and a movie 
studio have entered in to a business relationship to provide preferred transport of movies 
originated at that studio to subscribers on the cable operator network. In this example, 
assume that the content server 1500 connected to the Internet 1510 is not affiliated and 
has no arrangement with the MSO, but does carry movie files originated by the movie 
studio, and tagged for preferred transport by participating broadband access networks. 
As a condition for carrying its movie files, the movie studio in this example requires that 
this Content Server Node 1500 be equipped to retrieve, interpret and act upon content 
preferred transport tags under the present invention. 

[0168] The Content Server Node 1500 stores content files and the associated content 
tags for preferred transport as shown at step 2710. The subscriber at Client Node 2788 
requests content from the Content Server Node as shown in step 2720. The Content 
Server Node 1 500 retrieves the content along with its associated tag and inspects the tag 
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for authentication at step 2730. The Content Server Node 1 500 uses an Authentication 
URL contained in the content tag to perform authentication to an external Authentication 
Server Node 2700 associated with the content as shown at steps 2740 and 2750. 
Presumably, that authentication server 2700 is maintained by the movie studio as a means 
to control, monitor, and account for distribution of its movies via participating broadband 
access networks. 

[0169] If authentication is successful, then the content tag may be removed from its 
association or binding with the content file. Following successful authentication, the 
Content Server Node 1 500 transmits the content and instructs the Preferred Transporter 
1530 to give the content preferred transport. That preferred transporter 1530 could accept 
that instruction either based upon a prior trust relationship that the MSO owning the 
preferred transporter made with that content server 1 500, or due to an instruction by the 
MSO's movie studio partner to accept preferred transport instructions from that content 
server node 1500. For added security, authentication can also be executed between the 
preferred transporter node 1530 and that content server node 1500 employing any 
authentication method including those previously discussed in this specification. 
[0170] FIG 24a is a flowchart depicting a method for providing preferred transport in 
accordance with FIG 24. The preferred transporter receives a content header in content 
transmission 2591 and determines whether the content header contains a tag 2592. If the 
content header does not contain a tag, the content will be accorded standard transport 
2599. If the content header contains a tag, the preferred transporter then determines 
whether the tag includes an authentication URL 2593. If the tag does not include an 
authentication URL, the content will be accorded standard transport 2599. If the content 
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tag does include an authentication tag, the preferred transporter requests authentication 
from the authentication URL 2594 and determines whether the authentication is valid 
2595. If the authentication is not valid, the content is accorded standard transport 2599. 
If the authentication is valid, the preferred transporter retrieves the transfer profile for the 
signature 2596, for example, from a database of signatures and transport profiles 2597. 
The content is then accorded preferred transport 2598. 

[0171] FIG. 25 illustrates a content tag root naming tree in accordance with one aspect 
of the present invention. Such a contact tag root naming tree could be used, for example, 
to in creating the OID fieldsl90, 192, 194, 196 of FIG. 18. 

[0172] FIG. 26 illustrates a content class/type naming tree in accordance with one 

aspect of the present invention. Such a content class/type naming tree could be used, for 

example, to in creating the content class/type field 1 90 of FIG. 18. 

[0173] FIG. 27 illustrates a content application naming tree in accordance with one 

aspect of the present invention. Such a content application naming tree could be used, for 

example, to in creating the content application field 192 of FIG. 18. 

[0174] FIG. 28 illustrates a content origination naming tree in accordance with one 

aspect of the present invention. Such a content origination naming tree could be used, for 

example, to in creating the content originator field 190 of FIG. 18. 

[0175] Detailed illustrations of a scheme for recognizing and authenticating 

transmission payloads for preferred transport in accordance with the present invention 

have been provided for the edification of those of ordinary skill in the art, and not as a 

limitation of the scope of the invention. Numerous variations and modifications within 

the spirit of the present invention will of course occur to those of ordinary skill in the art 
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in view of the embodiments that have been disclosed. For example, while in the 
described embodiments, the present invention is implemented primarily for the benefit of 
a broadband Internet access provider, the present invention may also be effectively 
implemented for any facility providing access to a multimode digital communications 
network that can take advantage of the preferred transport implementation schemes of the 
present invention. Note that preferred transport can be a simplistic as allowing or 
denying access to content, content class and a robust as providing the distribution of 
certain content with exclusion of usage fees or byte cap restrictions. Preferred transport is 
not limited to bandwidth or broadband access but to any consumption of content by 
nodes, devices, subscribers, and any apparatus capable of digital (and/or analog) 
transmissions. The scope of the inventions should, therefore, be determined not with 
reference to the above description, but should instead be determined with reference to the 
appended claims, along with the full scope of equivalents to which such claims are 
entitled. 
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